CVE-2024-41380: 
PHP vulnerability analysis and mitigation

A Cross-Site Scripting (XSS) vulnerability was discovered in microweber version 2.0.16. The vulnerability exists in the file 'userfiles\modules\tags\add_tagging_tagged.php' and was reported on July 17, 2024 (GitHub Issue). The vulnerability has been assigned identifier CVE-2024-41380 and is currently awaiting full analysis by NIST (NVD).

The vulnerability stems from improper input validation in the add_tagging_tagged.php file. Specifically, the issue occurs when the application processes the 'taggable_id' parameter from POST requests without proper sanitization. The vulnerability exists between line 4 (source) where $_POST['taggable_id'] is processed and line 142 (sink) where the value is output. The CVSS v3.1 score assigned by CISA-ADP is 6.1 (MEDIUM) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (NVD).

The vulnerability allows an attacker to execute arbitrary JavaScript code in the context of other users' browsers who access the affected page. This could lead to theft of sensitive information, session hijacking, or other client-side attacks (NVD).

The vulnerability can be exploited by sending a specially crafted POST request to the /module/ endpoint with a malicious payload in the taggable_id parameter. A proof of concept exploit has been demonstrated using the payload: taggable_id="/>alert('xss')<" along with other required parameters (GitHub Issue).